Citrix patches NetScaler flaws enabling denial of service and bypass

Citrix has released patches for a set of critical vulnerabilities affecting NetScaler ADC, NetScaler Gateway, and NetScaler Console, with potential to cause denial-of-service or authentication bypass.

The vulnerabilities in NetScaler ADC and NetScaler Gateway include CVE-2026-120868 (CVSS 9.3), a memory overflow in Packet Processing that can trigger unpredictable behaviour or DoS across all NetScaler ADC and Gateway deployments; CVE-2026-107407 (CVSS 9.3), a memory overflow in SMPP traffic affecting NetScaler ADC configured with a Load Balancing or Content Switching virtual

server of type SMPP; CVE-2026-107408 (CVSS 9.3), a memory corruption in DNS/DNS-over-HTTPS (DoH) for DNS load balancing and recursive resolution; CVE-2026-107409 (CVSS 9.3), a memory corruption in DNS-over-HTTPS (DoH) for DNS Load Balancing over HTTPS; CVE-2026-107410 (CVSS 9.3), a memory overflow in NetScaler Push for Load Balancing virtual servers; CVE-2026-107412 (CVSS 9.5),

multiple memory overflow vulnerabilities affecting gateways or AAA virtual servers; CVE-2026-107415 (CVSS 9.3), a memory overflow in Email OTP authentication; CVE-2026-111344 (CVSS 9.3), memory overflow in Endpoint Analysis when configured as VPN or authentication (AAA) with EPA; and CVE-2026-120864 (CVSS 9.3), memory overflow in ICA proxy used by Gateway VPN, AAA or CR HDX virtual servers. Evidence and scope indicate impacts across NetScaler ADC, Gateway, and related VPN/authentication configurations.

Citrix also notes fixes for NetScaler Console and Secure Access Client for Windows and Linux, including CVE-2026-120869 (CVSS 9.4), an improper authentication vulnerability in NetScaler Console; CVE-2026-118268 (CVSS 8.5), improper privilege management in Secure Access Client for Windows enabling a low-privileged user to escalate to SYSTEM; and CVE-2026-118269 (CVSS 8.5), improper privilege management in Secure Access Client for Linux enabling privilege escalation to root.

Citrix says the updates follow an AI-assisted review of its codebase to harden products prior to threats materialising, and it asserts there are no known exploits at present; customers are urged to apply the updates to bolster NetScaler’s security posture. The patches cover releases 14.1-73.57 and later, 13.1-64.39 and later of 13.1, 14.1-FIPS 14.1-73.58 and later of 14.1-FIPS, and 13.1-FIPS and 13.1-NDcPP 13.1-37.293 and later of those lines.